GHSA-wwgf-3xp7-cxj4
Potentially sensitive data exposure in Symfony Web Socket Bundle
Impact
Inside Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish(), messages are arbitrarily broadcasted to the related Topic if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch() does not succeed. The dispatch() method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a Gos\Bundle\WebSocketBundle\Topic\TopicInterface implementation is not found for the callback, a topic which also implements Gos\Bundle\WebSocketBundle\Topic\SecuredTopicInterface rejects the connection, or an Exception is unhandled. This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.
Patches
In 1.10.4, 2.6.1, and 3.3.0, Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish() has been changed to no longer broadcast an event's data if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch() fails.
Workarounds
Upgrade to 1.10.4, 2.6.1, and 3.3.0
Note, the 1.x branch is considered end of support as of July 1, 2020.
For more information
If you have any questions or comments about this advisory:
- Open an issue in this repository
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Potentially sensitive data exposure in Symfony Web Socket Bundle
Impact
Inside Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish(), messages are arbitrarily broadcasted to the related Topic if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch() does not succeed. The dispatch() method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a Gos\Bundle\WebSocketBundle\Topic\TopicInterface implementation is not found for the callback, a topic which also implements Gos\Bundle\WebSocketBundle\Topic\SecuredTopicInterface rejects the connection, or an Exception is unhandled. This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.
Patches
In 1.10.4, 2.6.1, and 3.3.0, Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish() has been changed to no longer broadcast an event's data if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch() fails.
Workarounds
Upgrade to 1.10.4, 2.6.1, and 3.3.0
Note, the 1.x branch is considered end of support as of July 1, 2020.
For more information
If you have any questions or comments about this advisory:
- Open an issue in this repository
- Record
GHSA-wwgf-3xp7-cxj4- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Potentially sensitive data exposure in Symfony Web Socket Bundle
Impact
Inside Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish(), messages are arbitrarily broadcasted to the related Topic if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch() does not succeed. The dispatch() method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a Gos\Bundle\WebSocketBundle\Topic\TopicInterface implementation is not found for the callback, a topic which also implements Gos\Bundle\WebSocketBundle\Topic\SecuredTopicInterface rejects the connection, or an Exception is unhandled. This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.
Patches
In 1.10.4, 2.6.1, and 3.3.0, Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish() has been changed to no longer broadcast an event's data if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch() fails.
Workarounds
Upgrade to 1.10.4, 2.6.1, and 3.3.0
Note, the 1.x branch is considered end of support as of July 1, 2020.
For more information
If you have any questions or comments about this advisory:
- Open an issue in this repository
- Record
GHSA-wwgf-3xp7-cxj4- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gos/web-socket-bundlePackagist | before 1.10.4 | 1.10.4 |
gos/web-socket-bundlePackagist | 2.0.0 up to 2.6.1 | 2.6.1 |
gos/web-socket-bundlePackagist | 3.0.0 up to 3.3.0 | 3.3.0 |
gos/web-socket-bundlePackagist | before 1.10.4, plus listed versions V1.1.0v1.0.0v1.0.1v1.0.2v1.0.3 Show 45 moreShow lessv1.0.4v1.0.5v1.1.1v1.1.2v1.1.3v1.1.4v1.1.5v1.10.0v1.10.1v1.10.2v1.10.3v1.2.0v1.3.0v1.3.1v1.3.2v1.4.0v1.4.1v1.4.2v1.5.0v1.5.1v1.5.2v1.6.0v1.6.1v1.6.2v1.6.3v1.6.4v1.7.0v1.7.1v1.8.0v1.8.1v1.8.10v1.8.11v1.8.12v1.8.12-rc1v1.8.12-rc2v1.8.12-rc3v1.8.12-rc4v1.8.12-rc5v1.8.12-rc6v1.8.13v1.8.2v1.8.3v1.8.4v1.8.5v1.8.6 | 1.10.4 |
gos/web-socket-bundlePackagist | 2.0.0 up to 2.6.1, plus listed versions v2.0.0v2.1.0v2.2.0v2.3.0v2.3.1 Show 4 moreShow lessv2.3.2v2.4.0v2.5.0v2.6.0 | 2.6.1 |
gos/web-socket-bundlePackagist | 3.0.0 up to 3.3.0, plus listed versions v3.0.0v3.1.0v3.2.0 | 3.3.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-wwgf-3xp7-cxj4 is a medium vulnerability (CVSS 5.9) in gos/web-socket-bundle, published July 7, 2020. No source lists public exploit code. Fixed in gos/web-socket-bundle 1.10.4.
References
github.com/GeniusesOfSymfony/WebSocketBundle/security/advisories/GHSA-wwgf-3xp7-cxj4
snyk.io/vuln/SNYK-PHP-GOSWEBSOCKETBUNDLE-575401
Left out here: 8 versions. The JSON record has them.